malwarewikiaorg-20200223-history
Twitch Booster
Twitch Booster is a brand of viruses for Microsoft Windows. Although several versions of the virus exist, the term usually refers to its most destructive versions unofficially named "El Risitas Virus". The virus's sole purpose was for twitch raids. Payload The virus is highly disruptive and destructive. While some versions of the virus are only limited to what can be considered to be jokeware and scareware, the most disruptive version of the virus can go as far as erasing the MBR and widely wipe out the files inside the computer memory. The virus is most commonly found as a trick-named executable (usually named "twitchbooster-vx.x.exe" ). Once executed, the virus will activate the following payloads, with some slight variations depending of its strain. If the administrative rights are given, the computer MBR will be wiped out and a snake-like game will be loaded upon rebooting. Unlike what one can assume, one cannot "win" in the game and the MBR will not be restored upon succeeding at the game. The virus will fake its own installation as a legitimate software. The virus will first display a message in French, stating: Coucou, je suis juste la petite voix qui te dit que le 18-25 vient de détruire ton PC et ce à tout jamais. Amuse toi bien a le réparer fils de viol, très content. Dedi aux kheys du 18-25. Which roughly means in English as: Hi, I am but the little voice who announces you that the 18-25 just trashed your computer forever. Have fun trying to fix it, you son of a rapist, cheers. Mentions for my 18-25 buds. The virus will then kill the Task Bar processes, and will also close as many running softwares processes as possible, especialy internet browsers and video games. This is intended as a mean to spook the computer's users by forcing them to realize they lost control of their machine. The virus will then change the Desktop wallpaper with an image of Juan Joya Borja holding a sign dedicated to the user of jeuxvideo.com's "forum 18-25". This image originates from a video made by a forum member who happened to meet 'El Risitas' in the past. The virus will then hijack the computer's background sound output and play a very loud song named Issou Night Club, another meta reference to the "Forum 18-25". A melting effect will then be launched, working in a similar fashion as the MeltingScreen virus. If any CD tray is installed, it will start to randomly open. If any LED is installed on the keyboard's Ver Maj, Ver Num & Stop, they will start twitching on and off in a loop fashion. The virus will then start a five minute timer. It will display a pop-up with the following text: " Dans 5 minutes tu n'as plus de PC fils de viol, le 18-25 t'a bien baisé le cul :)" (which translates to: "In 5 minutes, you won't own a PC anymore, you son of a rapist, the 18-25 raped your ass real good. :)") A large number of pop-up will be generated with the following messages: "LE 18-25 T'A BIEN BAISÉ LE FION PUTAIN DE GROS FILS DE PUTE" (which translates to: "The 18-25 FUCKED YOUR ASSHOLE REAL GOOD YOU SON OF A WHORE") The virus will loop the generation of popup of a notorious offensive image known as the "screamer cactus" in which is an image of a male inserting a toy cactus into his anus. Finally, after the timer runs out, the virus will wipe out any files it encounters, including system files, forcing the system to crash and shut down. Infection As its name implies, this virus was crafted as a way to pull a prank on streamers. It usually involves a group of viewers complaining to the Twitch streamer that their streams went blurry and pixelated, encouraging the former to look for a fix (even when in reality the stream works just fine). Soon after, a viewer will send a link to the virus, claiming it to be a working software to boost the stream performances. While sometimes the streamer is tricked into a rather harmless version of the virus, it is highly possible the trolling will force the streamer to reformat the streamer's system. The virus does not manage to fool Windows Defender and many antiviruses, so most of the time, the trolls will encourage to disable it along with any antivirus, claiming the virus is a false positive. Despite its very destructive nature, no known version of the virus can activate itself without being manually launched via its executable. The virus originates from what is widely considered to be the French equivalent of 4chan's /b/, namely the "forum 18-25", hosted by the video-game themed website jeuxvideo.com (although it shares a great number of users and references with both sister websites avenoel.org & 2sucres.org). According to jvfulx (jeuxvideo.com's unofficial wiki), the destructive version of TwichBooster described above was crafted and programmed by a forum member by the name of Jewstice. The visual payloads of the virus revolves a lot around the Spanish comedian Juan Joya Borja aka "El Risita", considered as an idol figure of jeuxvideo.com's inside culture. The virus itself can be considered as an extention of the many online goodies originated from Juan's famous 2007 interview, along with dozens of image stickers, subtitles parodies, photoshoped videos, wiki raids and even mixed songs. Media ]] Category:Joke programs Category:Virus Category:Microsoft Windows Category:Rogue software